3

If a host on a network is permitted to access another host on a different network via an ACL on the source host's router, does that automatically deny other hosts on the same network as the source host?

If you need something 100% answerable, here's is a situation:

There are two networks, and three hosts:

Network A - 172.50.2.0/27:

172.50.2.13 (hostA, PC)
172.50.2.14 (hostB, PC)

Network B - 172.40.2.0/27:

172.40.2.21 (hostC, webserver)

If hostA wants to connect to hostC, but the following ACL is placed on hostA & B's router interface connected to their switch:

100 permit tcp host 172.50.2.14 host 172.40.2.21 eq www

Is hostA automatically denied when trying to connect to hostC webserver because only hostB was permitted? Or is it allowed as the whole network wasn't denied, even though hostA wasn't given an explicit permit entry?

Also, if I were to add:

100 permit ip any any

to the end of the ACL, would hostA still be unable to connect to the webserver?

Improve this question
4
  • You need to give us more information. For example, what are the networks masks? It appears that A and B may be on the same network, so traffic between them would not pass through the router. You need to edit the question to give us the full ACL, and it would be better if we had the full configuration.
    – Ron Maupin ♦
    Jan 16, 2018 at 20:11
  • This is the full ACL. A & B are on the same network. C is on a different network. A is trying to connect to C. B isn't doing anything.
    – YMGenesis
    Jan 16, 2018 at 20:15
  • There really is more to it than that. It is applied to which interlace, in which direction (in or out)?
    – Ron Maupin ♦
    Jan 16, 2018 at 20:17
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Apr 1, 2018 at 19:53

1 Answer 1

Reset to default
3

Cisco access lists have an implicit deny if no statement match.

So if the traffic match none of the rules of the access list, it is blocked (I.E. the packet is discarded).

Edit:
A rule with "permit ip any any" will obviously match any traffic and the ACL will not block anything that hasn't be explicitly denied by a previous statement.

Also note that the ACL evaluation stop at the first rule that match. The action associated with this rule is then applied, and the following rules are not evaluated at all.

Improve this answer
2
  • I didn't know traffic was implicitly denied if it didn't match any ACL entries. Thanks for the information, it seems to be my answer. If I were to add 100 permit ip any any to the end of the ACL, would hostA still be denied?
    – YMGenesis
    Jan 16, 2018 at 20:20
  • 100 permit ... overwrites the ACE from your question. You should use something like 9999 permit .... to stick to the end.
    – Zac67 ♦
    Jan 16, 2018 at 21:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.